CVE Statistics: December 2025

🌐 Discover the key figures for vulnerabilities published in December 2025 on CVE Find.

🔎 Overview

• Total number of CVEs published : 5,645 (+81.2% vs the previous month)
• Vulnerabilities added to the CISA KEV catalog : 20

📂 Breakdown by main categories

• Cross-site Scripting : 816
• Authorization problems : 673
• SQL Injection : 284
• Overflow : 277
• Cross-Site Request Forgery - CSRF : 191
• Directory Traversal : 138

📈 Breakdown by CVSS score

• Low : 118
• Medium : 2328
• High : 1867
• Critical : 452

🏢 Most affected vendors

1. microsoft : 137
2. adobe : 135
3. google : 131
4. apple : 114
5. axiomthemes : 58

📦 Most affected products

1. adobe experience_manager : 115
2. google android : 111
3. apple macos : 110
4. microsoft windows : 72
5. linux linux_kernel : 52

⚠️ Notable CVEs of the month

• CVE-2025-52691 (10 CRITICAL) : Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote co...
• CVE-2025-54322 (10 CRITICAL) : Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.
• CVE-2025-66203 (10 CRITICAL) : StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplicat...
• CVE-2025-66209 (10 CRITICAL) : Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerabi...
• CVE-2025-14931 (10 CRITICAL) : Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit...

Explore all the data in detail on CVE Find.